Hackers Use GitHub PowerShell and WinRAR Exploit to Target CIS Governments

Hackers are using GitHub-hosted PowerShell scripts and a WinRAR vulnerability to target government organizations across the Commonwealth of Independent States (CIS).

Cisco Talos and Recorded Future’s Insikt Group investigated the activity, tracked as UAT-6275 by Talos and TAG-193 by Recorded Future.

The investigation covered activity from June 2025 through August 2026 and identified four malware delivery methods.

Attackers used malicious documents, executable downloaders, Windows shortcuts, and a crafted archive to install reverse shells, which let operators remotely issue commands on infected computers.

Observed victims and lure themes covered nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

Targets included institutions handling diplomacy, economic development, agriculture, and environmental management. Recovered documents also showed interest in water resources and energy supplies.

Hackers Target CIS Governments

The first infection chain, observed in June 2025, used macro-enabled Microsoft Word documents to download and run a second-stage binary. These documents formed the earliest delivery method identified in the reviewed activity.

In July 2025, researchers observed downloaders created with PS2EXE, a tool that converts PowerShell scripts into standalone Windows executables.

These downloaders retrieved reverse-shell payloads and created scheduled tasks to maintain access on compromised systems.

A third chain appeared in October 2025. Malicious Windows shortcuts launched PowerShell, which downloaded and executed a script hosted on GitHub. The script provided remote shell access. Later versions also downloaded PickleShell and placed it in the Windows Startup folder for persistence.

In April 2026, the attackers added a WinRAR exploit. A specially crafted RAR archive exploited CVE-2025-8088 to place PickleShell in the Startup folder.

The malware then ran when the user next signed in. Talos said this was the first vulnerability exploit observed in the group’s malware delivery.

Alongside PickleShell, the group used lightweight reverse shells named Chvost and Laplas. These tools enabled interactive command execution, giving attackers a way to control compromised systems after initial infection.

Researchers discovered three publicly accessible staging directories and a previously unreported GitHub repository containing malicious scripts and payloads.

Repository commit history exposed malware development and changes to command-and-control infrastructure, helping investigators track the group’s operations.

Recovered files included Linux-compatible tools and a public proof-of-concept exploit for FortiWeb vulnerability CVE-2025-25257.

Their presence suggests preparations for broader operations against Linux systems and internet-facing appliances, but does not establish that those tools were successfully deployed against victims,

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team